Domain Join fails with univention-domain-join-cli from Ubuntu 22.04 Server

UCS - Univention Corporate Server
1

Hi

Our Servers are in different VLANs, the Primary and Backup Domain Node are in the DMZ xxx.xxx.14.xx, and the Ubuntu Server I want to Join as Managed Node is in the WEB-Server VLAN xxx.xxx.12.xx. A ping from one server to the other works fine, the Routes/Rules are on the Firewall and all Ports allowed.

I think I made a misstake when I installed the Join Script, when it prompts some question. As it asked for the Domain Servers, I insert the FQDN with the Domain as [myDomServer].[myDomain].local and instead I think should just insert just the Hostname of the Server. I allready tryed to uninstall and purge the Join-Script, the Repo and to reinstall it to get the prompt again, but the prompt dosn’t come anymore and what I insert stays in the configuration of the script. I also tryed to find where these information was stored, but I didn’t find it.

However, when I’m trying to join the Domain with the Server, I get an error: An error occurred: The UCS master name [myDomServer].[myDomain].local can not be resolved, please check your DNS settings. in LOG is nothing more as the same Error message.

In the Univention Server I insert all Networks and in the DNS are all Zones registred, see pictures included. For Security reasons I masked the full IP, Host- and Domain.

UCS_Networks
UCS_DNS

So my question is, if I configured something wrong, or if I forgot to configure something somewhere on the Domain Servers?

Thank you in advance for your quick reply.

Best regards
Andrea

2

How to you installed the jointools? Like this?

add-apt-repository ppa:univention-dev/ppa -n -y
DEBIAN_FRONTEND=noninteractive apt-get install univention-domain-join krb5-auth-dialog -y
3

As described here:

So, not as you mentioning in your reply. I will give them a try.

Thanks

4

Hi again

I gave them a try, but it didn’t work. The initial Dialog didn’t come up and I couldn’t reconfigure the Script.

Still get the Error Message.

Somebody some other Idea?

Thanks

5

Moin,

I have not worked on this component, but based on looking over the code briefly maybe the following can help.
If you call the script via the commandline (sudo univention-domain-join-cli) instead of the GUI there is the option to explicitly supply a domainname or the IP to join against:

Best regards
Jan-Luca

6

Hi Jan-Luca

Thanks for your Input.

It is a Ubuntu Server without GUI, so it happens everything on CLI and I allready set he Arguments --domain as well --dc-ip and dosn’t helps.

Best regards
Andrea

7

…to complete the information, these is the command I use to do the join:

sudo univention-domain-join-cli --username [myUserWithAdminRights] --password [myPassword] --skip-login-manager --domain [myDomain].local --dc-ip [IPofPrimaryNode]
8

Can you try it again with only the IP? The initial DNS error should be solved if there is no name to resolve.

9

Can you try it again with only the IP? The initial DNS error should be solved if there is no name to resolve.

Allready tryed, dosn’t work either. Same Error.

10

Well, does the resolving work in general? Can you try the following:

dig <myDomServer>.<myDomain>.local @<IP of Primary> +short
dig <myDomServer> @<IP of Primary> +short
11

It seams to resolve:

dig [myHost].[myDomain].local @xxx.xx.14.xx

; <<>> DiG 9.18.12-0ubuntu0.22.04.3-Ubuntu <<>> [myHost].[myDomain].local @xxx.xx.14.xx
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48877
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: ae92ad66ff0834505590a7c1653a6128add137cbd214967b (good)
;; QUESTION SECTION:
;[myHost].[myDomain].local.       IN      A

;; ANSWER SECTION:
[myHost].[myDomain].local. 900    IN      A       xx.xx.14.xx

;; AUTHORITY SECTION:
[myDomain].local.             900     IN      NS      [myBackupNode].[myDomain].local.
[myDomain].local.             900     IN      NS      [myHost].[myDomain].local.

;; ADDITIONAL SECTION:
[myBackupNode].[myDomain].local. 900    IN      A       xxx.xx.14.xx

;; Query time: 0 msec
;; SERVER: xxx.xx.14.xx#53(xxx.xx.14.xx) (UDP)
;; WHEN: Thu Oct 26 14:53:06 CEST 2023
;; MSG SIZE  rcvd: 153

Additional I want to mention taht I don’t use the root for the join and that I disabled Remote Login for root User.

Meanwhile I also set up a 2nd Ubuntu Serevr to test more things, and I also tryed to move it from the VLAN 12, where the real server is situated, to the same VLAN 14 as the Domain Nodes. Same Error.

12

I was now able to join the Domain with the Test-Server. I just had to modify the /etc/resolv.conf and add the Domain and DNS Servers manually. After that, the Join Script worked fine.

But now i have the Problem that it generated a simple “Ubuntu” Object and I don’t see it as a Member Server/Managed Node and use it for Shares. I moved the Object in LDAP to [myDomain].local:/computers/memberserver, but it didn’t help. So I have to change the Type to “Managed Node” but I can only create such an object, but can’t change the joined Server.

Somebody know how to do that?

Thanks
Andrea